
--Apple-Mail=_B78E14EB-413D-4DC1-AC54-F837E05B2CF8 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii I tried to add a user in ovirt, but it's not identified: 2017-06-28 16:48:48,505+02 ERROR = [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-22) = [] External Authentication Failed: Cannot resolve principal = 'rexecutor@internal' /usr/bin/ovirt-aaa-jdbc-tool user show rexecutor -- User rexecutor(b1727291-5ad4-4575-b8ec-53bdc9ce4aef) -- Namespace: * Name: rexecutor ID: b1727291-5ad4-4575-b8ec-53bdc9ce4aef Display Name:=20 Email:=20 First Name:=20 Last Name:=20 Department:=20 Title:=20 Description:=20 Account Disabled: false Account Locked: false Account Unlocked At: 2017-06-16 13:49:31Z Account Valid From: 2017-06-15 16:41:14Z Account Valid To: 2217-06-15 16:41:14Z Account Without Password: true Last successful Login At: 1970-01-01 00:00:00Z Last unsuccessful Login At: 1970-01-01 00:00:00Z Password Valid To: 2025-08-15 10:30:00Z It's listed as a known user: <user = href=3D"/ovirt-engine/api/users/49a12b6e-de03-4095-b6ed-2c1883f5542e" = id=3D"49a12b6e-de03-4095-b6ed-2c1883f5542e"> <department></department> = <domain_entry_id>62313732373239312D356164342D343537352D623865632D353362646= 339636534616566</domain_entry_id> <email></email> <last_name></last_name> <name></name> <namespace>*</namespace> <principal>rexecutor</principal> <user_name>rexecutor@internal-authz</user_name> <domain href=3D"/ovirt-engine/api/domains/696E7465726E616C2D617574687A" = id=3D"696E7465726E616C2D617574687A"> <name>internal-authz</name> </domain> <permissions = href=3D"/ovirt-engine/api/users/49a12b6e-de03-4095-b6ed-2c1883f5542e/permi= ssions"/> <roles = href=3D"/ovirt-engine/api/users/49a12b6e-de03-4095-b6ed-2c1883f5542e/roles= "/> <ssh_public_keys = href=3D"/ovirt-engine/api/users/49a12b6e-de03-4095-b6ed-2c1883f5542e/sshpu= blickeys"/> <tags = href=3D"/ovirt-engine/api/users/49a12b6e-de03-4095-b6ed-2c1883f5542e/tags"= /> </user> My admin domain authentication looks OK: = config.datasource.jdbcurl=3Djdbc:postgresql://pgdb:5432/ovirt_engine?sslfa= ctory=3Dorg.postgresql.ssl.NonValidatingFactory config.datasource.dbuser=3Dovirt config.datasource.dbpassword=3DXXX config.datasource.jdbcdriver=3Dorg.postgresql.Driver config.datasource.schemaname=3Daaa_jdbc It tried to increase org.ovirt.engine.core.sso.utils debug log level by = modifying = /usr/share/ovirt-engine/services/ovirt-engine/ovirt-engine.xml.in diff ovirt-engine.xml.in* 201,204d200 < <logger category=3D"org.ovirt.engine.core.sso.utils"> < <level name=3D"ALL"/> < </logger> <=20 I just got in the log: 2017-06-28 17:17:09,404+02 DEBUG = [org.ovirt.engine.core.sso.utils.NonInteractiveAuth] (default task-7) [] = Performing Negotiate Auth 2017-06-28 17:17:09,404+02 DEBUG = [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-7) [] = Performing external authentication 2017-06-28 17:17:09,410+02 ERROR = [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-7) [] = External Authentication Failed: Cannot resolve principal = 'rexecutor@internal' 2017-06-28 17:17:09,410+02 DEBUG = [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-7) [] = External Authentication Failed: Class: class = org.ovirt.engine.core.extensions.mgr.ExtensionInvokeCommandFailedException= Input: {Extkey[name=3DEXTENSION_INVOKE_COMMAND;type=3Dclass = org.ovirt.engine.api.extensions.ExtUUID;uuid=3DEXTENSION_INVOKE_COMMAND[48= 5778ab-bede-4f1a-b823-77b262a2f28d];]=3DAAA_AUTHZ_FETCH_PRINCIPAL_RECORD[5= a5bf9bb-9336-4376-a823-26efe1ba26df], = Extkey[name=3DAAA_AUTHZ_QUERY_FLAGS;type=3Dclass = java.lang.Integer;uuid=3DAAA_AUTHZ_QUERY_FLAGS[97d226e9-8d87-49a0-9a7f-af6= 89320907b];]=3D3, Extkey[name=3DEXTENSION_INVOKE_CONTEXT;type=3Dclass = org.ovirt.engine.api.extensions.ExtMap;uuid=3DEXTENSION_INVOKE_CONTEXT[886= d2ebb-312a-49ae-9cc3-e1f849834b7d];]=3D{Extkey[name=3DAAA_AUTHZ_AVAILABLE_= NAMESPACES;type=3Dinterface = java.util.Collection;uuid=3DAAA_AUTHZ_AVAILABLE_NAMESPACES[6dffa34c-955f-4= 86a-bd35-0a272b45a711];]=3D[DC=3DXXX], = Extkey[name=3DEXTENSION_LICENSE;type=3Dclass = java.lang.String;uuid=3DEXTENSION_LICENSE[8a61ad65-054c-4e31-9c6d-1ca4d60a= 4c18];]=3DASL 2.0, Extkey[name=3DEXTENSION_GLOBAL_CONTEXT;type=3Dclass = org.ovirt.engine.api.extensions.ExtMap;uuid=3DEXTENSION_GLOBAL_CONTEXT[979= 9e72f-7af6-4cf1-bf08-297bc8903676];]=3D*skip*, = Extkey[name=3DEXTENSION_NAME;type=3Dclass = java.lang.String;uuid=3DEXTENSION_NAME[651381d3-f54f-4547-bf28-b0b01a10318= 4];]=3Dovirt-engine-extension-aaa-ldap.authz, = Extkey[name=3DEXTENSION_MANAGER_TRACE_LOG;type=3Dinterface = org.slf4j.Logger;uuid=3DEXTENSION_MANAGER_TRACE_LOG[863db666-3ea7-4751-969= 5-918a3197ad83];]=3Dorg.slf4j.impl.Slf4jLogger(org.ovirt.engine.core.exten= sions.mgr.ExtensionsManager.trace.ovirt-engine-extension-aaa-ldap.authz.XX= X-authz), = Extkey[name=3DEXTENSION_CONFIGURATION_SENSITIVE_KEYS;type=3Dinterface = java.util.Collection;uuid=3DEXTENSION_CONFIGURATION_SENSITIVE_KEYS[a456efa= 1-73ff-4204-9f9b-ebff01e35263];]=3D[], = Extkey[name=3DEXTENSION_VERSION;type=3Dclass = java.lang.String;uuid=3DEXTENSION_VERSION[fe35f6a8-8239-4bdb-ab1a-af9f779c= e68c];]=3D1.3.1, Extkey[name=3DEXTENSION_PROVIDES;type=3Dinterface = java.util.Collection;uuid=3DEXTENSION_PROVIDES[8cf373a6-65b5-4594-b828-0e2= 75087de91];]=3D[org.ovirt.engine.api.extensions.aaa.Authz], = Extkey[name=3DEXTENSION_AUTHOR;type=3Dclass = java.lang.String;uuid=3DEXTENSION_AUTHOR[ef242f7a-2dad-4bc5-9aad-e07018b7f= bcc];]=3DThe oVirt Project, Extkey[name=3DEXTENSION_LOCALE;type=3Dclass = java.lang.String;uuid=3DEXTENSION_LOCALE[0780b112-0ce0-404a-b85e-8765d778b= b29];]=3Den_US, Extkey[name=3DEXTENSION_CONFIGURATION_FILE;type=3Dclass = java.lang.String;uuid=3DEXTENSION_CONFIGURATION_FILE[4fb0ffd3-983c-4f3f-98= ff-9660bd67af6a];]=3D/etc/ovirt-engine/extensions.d/XXXX-authz.properties,= Extkey[name=3DEXTENSION_HOME_URL;type=3Dclass = java.lang.String;uuid=3DEXTENSION_HOME_URL[4ad7a2f4-f969-42d4-b399-72d192e= 18304];]=3Dhttp://www.ovirt.org, = Extkey[name=3DEXTENSION_CONFIGURATION;type=3Dclass = java.util.Properties;uuid=3DEXTENSION_CONFIGURATION[2d48ab72-f0a1-4312-b4a= e-5068a226b0fc];]=3D***, = Extkey[name=3DEXTENSION_INTERFACE_VERSION_MAX;type=3Dclass = java.lang.Integer;uuid=3DEXTENSION_INTERFACE_VERSION_MAX[f4cff49f-2717-490= 1-8ee9-df362446e3e7];]=3D0, = Extkey[name=3DAAA_AUTHZ_QUERY_MAX_FILTER_SIZE;type=3Dclass = java.lang.Integer;uuid=3DAAA_AUTHZ_QUERY_MAX_FILTER_SIZE[2eb1f541-0f65-44a= 1-a6e3-014e247595f5];]=3D50, = Extkey[name=3DEXTENSION_INTERFACE_VERSION_MIN;type=3Dclass = java.lang.Integer;uuid=3DEXTENSION_INTERFACE_VERSION_MIN[2b84fc91-305b-497= b-a1d7-d961b9d2ce0b];]=3D0, = Extkey[name=3DEXTENSION_INSTANCE_NAME;type=3Dclass = java.lang.String;uuid=3DEXTENSION_INSTANCE_NAME[65c67ff6-aeca-4bd5-a245-86= 74327f011b];]=3DXXXX-authz, = Extkey[name=3DEXTENSION_BUILD_INTERFACE_VERSION;type=3Dclass = java.lang.Integer;uuid=3DEXTENSION_BUILD_INTERFACE_VERSION[cb479e5a-4b23-4= 6f8-aed3-56a4747a8ab7];]=3D0, Extkey[name=3DEXTENSION_NOTES;type=3Dclass = java.lang.String;uuid=3DEXTENSION_NOTES[2da5ad7e-185a-4584-aaff-97f66978e4= ea];]=3DDisplay name: = ovirt-engine-extension-aaa-ldap-1.3.1-1.el7.centos}, = Extkey[name=3DAAA_AUTHN_AUTH_RECORD;type=3Dclass = org.ovirt.engine.api.extensions.ExtMap;uuid=3DAAA_AUTHN_AUTH_RECORD[e94621= 68-b53b-44ac-9af5-f25e1697173e];]=3D{Extkey[name=3DAAA_AUTHN_AUTH_RECORD_P= RINCIPAL;type=3Dclass = java.lang.String;uuid=3DAAA_AUTHN_AUTH_RECORD_PRINCIPAL[c3498f07-11fe-464c= -958c-8bd7490b119a];]=3Drexecutor@internal}} Output: {Extkey[name=3DEXTENSION_INVOKE_MESSAGE;type=3Dclass = java.lang.String;uuid=3DEXTENSION_INVOKE_MESSAGE[b7b053de-dc73-4bf7-9d26-b= 8bdb72f5893];]=3DCannot resolve principal 'rexecutor@internal', = Extkey[name=3DEXTENSION_INVOKE_RESULT;type=3Dclass = java.lang.Integer;uuid=3DEXTENSION_INVOKE_RESULT[0909d91d-8bde-40fb-b6c0-0= 99c772ddd4e];]=3D2} at = org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.= java:95) [extensions-manager.jar:] at = org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.= java:109) [extensions-manager.jar:] at = org.ovirt.engine.core.sso.utils.NegotiateAuthUtils.doAuth(NegotiateAuthUti= ls.java:122) [enginesso.jar:] at = org.ovirt.engine.core.sso.utils.NegotiateAuthUtils.doAuth(NegotiateAuthUti= ls.java:68) [enginesso.jar:] at = org.ovirt.engine.core.sso.utils.NonInteractiveAuth$2.doAuth(NonInteractive= Auth.java:51) [enginesso.jar:] at = org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.issueTokenUsingHttpHe= aders(OAuthTokenServlet.java:183) [enginesso.jar:] at = org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.service(OAuthTokenSer= vlet.java:72) [enginesso.jar:] at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) = [jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final] at = io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.j= ava:85) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:129) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = org.ovirt.engine.core.branding.BrandingFilter.doFilter(BrandingFilter.java= :73) [branding.jar:] at = io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:131) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = org.ovirt.engine.core.utils.servlet.LocaleFilter.doFilter(LocaleFilter.jav= a:66) [utils.jar:] at = io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:131) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = org.ovirt.engine.core.utils.servlet.HeaderFilter.doFilter(HeaderFilter.jav= a:94) [utils.jar:] at = io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:131) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.jav= a:84) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleReq= uest(ServletSecurityRoleHandler.java:62) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(Servl= etDispatchingHandler.java:36) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.= handleRequest(SecurityContextAssociationHandler.java:78) at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.han= dleRequest(SSLInformationAssociationHandler.java:131) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.han= dleRequest(ServletAuthenticationCallHandler.java:57) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.security.handlers.AuthenticationConstraintHandler.handleReques= t(AuthenticationConstraintHandler.java:53) = [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest= (AbstractConfidentialityHandler.java:46) = [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHand= ler.handleRequest(ServletConfidentialityConstraintHandler.java:64) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.han= dleRequest(ServletSecurityConstraintHandler.java:59) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.security.handlers.AuthenticationMechanismsHandler.handleReques= t(AuthenticationMechanismsHandler.java:60) = [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.ha= ndleRequest(CachedAuthenticatedSessionHandler.java:77) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(No= tificationReceiverHandler.java:50) = [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.ha= ndleRequest(AbstractSecurityContextAssociationHandler.java:43) = [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRe= quest(JACCContextIdHandler.java:61) at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(Serv= letInitialHandler.java:292) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletIniti= alHandler.java:81) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHa= ndler.java:138) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHa= ndler.java:135) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(Ser= vletRequestContextThreadSetupAction.java:48) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClass= LoaderSetupAction.java:43) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(Servlet= InitialHandler.java:272) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletIniti= alHandler.java:81) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(Servlet= InitialHandler.java:104) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) = [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:805) = [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:= 1142) [rt.jar:1.8.0_121] at = java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java= :617) [rt.jar:1.8.0_121] at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_121] 2017-06-28 17:17:09,414+02 DEBUG = [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-7) [] = External Authentication result: false 2017-06-28 17:17:09,414+02 ERROR = [org.ovirt.engine.core.sso.utils.SsoUtils] (default task-7) [] = OAuthException access_denied: Cannot authenticate user Authentication = failed.. 2017-06-28 17:17:09,414+02 DEBUG = [org.ovirt.engine.core.sso.utils.SsoUtils] (default task-7) [] = Exception: org.ovirt.engine.core.sso.utils.OAuthException: Cannot = authenticate user Authentication failed.. at = org.ovirt.engine.core.sso.utils.SsoUtils.sendJsonDataWithMessage(SsoUtils.= java:569) [enginesso.jar:] at = org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.service(OAuthTokenSer= vlet.java:81) [enginesso.jar:] at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) = [jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final] at = io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.j= ava:85) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:129) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = org.ovirt.engine.core.branding.BrandingFilter.doFilter(BrandingFilter.java= :73) [branding.jar:] at = io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:131) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = org.ovirt.engine.core.utils.servlet.LocaleFilter.doFilter(LocaleFilter.jav= a:66) [utils.jar:] at = io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:131) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = org.ovirt.engine.core.utils.servlet.HeaderFilter.doFilter(HeaderFilter.jav= a:94) [utils.jar:] at = io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:131) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.jav= a:84) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleReq= uest(ServletSecurityRoleHandler.java:62) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(Servl= etDispatchingHandler.java:36) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.= handleRequest(SecurityContextAssociationHandler.java:78) at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.han= dleRequest(SSLInformationAssociationHandler.java:131) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.han= dleRequest(ServletAuthenticationCallHandler.java:57) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.security.handlers.AuthenticationConstraintHandler.handleReques= t(AuthenticationConstraintHandler.java:53) = [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest= (AbstractConfidentialityHandler.java:46) = [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHand= ler.handleRequest(ServletConfidentialityConstraintHandler.java:64) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.han= dleRequest(ServletSecurityConstraintHandler.java:59) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.security.handlers.AuthenticationMechanismsHandler.handleReques= t(AuthenticationMechanismsHandler.java:60) = [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.ha= ndleRequest(CachedAuthenticatedSessionHandler.java:77) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(No= tificationReceiverHandler.java:50) = [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.ha= ndleRequest(AbstractSecurityContextAssociationHandler.java:43) = [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRe= quest(JACCContextIdHandler.java:61) at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(Serv= letInitialHandler.java:292) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletIniti= alHandler.java:81) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHa= ndler.java:138) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHa= ndler.java:135) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(Ser= vletRequestContextThreadSetupAction.java:48) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClass= LoaderSetupAction.java:43) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(Servlet= InitialHandler.java:272) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletIniti= alHandler.java:81) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(Servlet= InitialHandler.java:104) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) = [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:805) = [undertow-core-1.4.0.Final.jar:1.4.0.Final] at = java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:= 1142) [rt.jar:1.8.0_121] at = java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java= :617) [rt.jar:1.8.0_121] at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_121] Caused by: org.ovirt.engine.core.sso.utils.AuthenticationException: = Cannot authenticate user Authentication failed.. at = org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.issueTokenUsingHttpHe= aders(OAuthTokenServlet.java:214) [enginesso.jar:] at = org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.service(OAuthTokenSer= vlet.java:72) [enginesso.jar:] ... 50 more 2017-06-28 17:17:09,419+02 TRACE = [org.ovirt.engine.core.sso.utils.SsoUtils] (default task-7) [] Sending = json data {"error_code":"access_denied","error":"Cannot authenticate = user Authentication failed.."} --Apple-Mail=_B78E14EB-413D-4DC1-AC54-F837E05B2CF8 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dus-ascii"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" = class=3D"">I tried to add a user in ovirt, but it's not identified:<div = class=3D""><div style=3D"margin: 0px; font-size: 11px; line-height: = normal; font-family: Menlo;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">2017-06-28 16:48:48,505+02 ERROR = [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-22) = [] External Authentication Failed: Cannot resolve principal = 'rexecutor@internal'</span></div></div><div class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><br = class=3D""></span></div><div class=3D""><br class=3D""><div = class=3D""><div style=3D"margin: 0px; font-size: 11px; line-height: = normal; font-family: Menlo;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">/usr/bin/ovirt-aaa-jdbc-tool user show = rexecutor</span></div><div style=3D"margin: 0px; font-size: 11px; = line-height: normal; font-family: Menlo;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D"">-- User = rexecutor(b1727291-5ad4-4575-b8ec-53bdc9ce4aef) --</span></div><div = style=3D"margin: 0px; font-size: 11px; line-height: normal; font-family: = Menlo;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D"">Namespace: *</span></div><div = style=3D"margin: 0px; font-size: 11px; line-height: normal; font-family: = Menlo;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D"">Name: rexecutor</span></div><div = style=3D"margin: 0px; font-size: 11px; line-height: normal; font-family: = Menlo;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D"">ID: = b1727291-5ad4-4575-b8ec-53bdc9ce4aef</span></div><div style=3D"margin: = 0px; font-size: 11px; line-height: normal; font-family: Menlo;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">Display Name: </span></div><div style=3D"margin: 0px; = font-size: 11px; line-height: normal; font-family: Menlo;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">Email: </span></div><div style=3D"margin: 0px; = font-size: 11px; line-height: normal; font-family: Menlo;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">First Name: </span></div><div style=3D"margin: 0px; = font-size: 11px; line-height: normal; font-family: Menlo;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">Last Name: </span></div><div style=3D"margin: 0px; = font-size: 11px; line-height: normal; font-family: Menlo;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">Department: </span></div><div style=3D"margin: 0px; = font-size: 11px; line-height: normal; font-family: Menlo;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">Title: </span></div><div style=3D"margin: 0px; = font-size: 11px; line-height: normal; font-family: Menlo;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">Description: </span></div><div style=3D"margin: 0px; = font-size: 11px; line-height: normal; font-family: Menlo;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">Account Disabled: false</span></div><div style=3D"margin: = 0px; font-size: 11px; line-height: normal; font-family: Menlo;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">Account Locked: false</span></div><div style=3D"margin: 0px; = font-size: 11px; line-height: normal; font-family: Menlo;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">Account Unlocked At: 2017-06-16 13:49:31Z</span></div><div = style=3D"margin: 0px; font-size: 11px; line-height: normal; font-family: = Menlo;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D"">Account Valid From: 2017-06-15 = 16:41:14Z</span></div><div style=3D"margin: 0px; font-size: 11px; = line-height: normal; font-family: Menlo;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D"">Account = Valid To: 2217-06-15 16:41:14Z</span></div><div style=3D"margin: 0px; = font-size: 11px; line-height: normal; font-family: Menlo;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">Account Without Password: true</span></div><div = style=3D"margin: 0px; font-size: 11px; line-height: normal; font-family: = Menlo;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D"">Last successful Login At: 1970-01-01 = 00:00:00Z</span></div><div style=3D"margin: 0px; font-size: 11px; = line-height: normal; font-family: Menlo;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D"">Last = unsuccessful Login At: 1970-01-01 00:00:00Z</span></div><div = style=3D"margin: 0px; font-size: 11px; line-height: normal; font-family: = Menlo;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D"">Password Valid To: 2025-08-15 = 10:30:00Z</span></div></div><div class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><br = class=3D""></span></div><div class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D"">It's = listed as a known user:</span></div><div class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><div = style=3D"margin: 0px; font-size: 11px; line-height: normal; font-family: = Menlo;" class=3D""><div style=3D"margin: 0px; line-height: normal;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D""><user = href=3D"/ovirt-engine/api/users/49a12b6e-de03-4095-b6ed-2c1883f5542e" = id=3D"49a12b6e-de03-4095-b6ed-2c1883f5542e"></span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> = <department></department></span></div><div style=3D"margin: = 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> = <domain_entry_id>62313732373239312D356164342D343537352D623865632D353= 362646339636534616566</domain_entry_id></span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> = <email></email></span></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""> = <last_name></last_name></span></div><div style=3D"margin: = 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> = <name></name></span></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""> = <namespace>*</namespace></span></div><div style=3D"margin: = 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> = <principal>rexecutor</principal></span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> = <user_name>rexecutor@internal-authz</user_name></span></div><d= iv style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> = <domain href=3D"/ovirt-engine/api/domains/696E7465726E616C2D617574687A"= id=3D"696E7465726E616C2D617574687A"></span></div><div style=3D"margin:= 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> = <name>internal-authz</name></span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> = </domain></span></div><div style=3D"margin: 0px; line-height: = normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""> <permissions = href=3D"/ovirt-engine/api/users/49a12b6e-de03-4095-b6ed-2c1883f5542e/permi= ssions"/></span></div><div style=3D"margin: 0px; line-height: = normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""> <roles = href=3D"/ovirt-engine/api/users/49a12b6e-de03-4095-b6ed-2c1883f5542e/roles= "/></span></div><div style=3D"margin: 0px; line-height: normal;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D""> <ssh_public_keys = href=3D"/ovirt-engine/api/users/49a12b6e-de03-4095-b6ed-2c1883f5542e/sshpu= blickeys"/></span></div><div style=3D"margin: 0px; line-height: = normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""> <tags = href=3D"/ovirt-engine/api/users/49a12b6e-de03-4095-b6ed-2c1883f5542e/tags"= /></span></div><div style=3D"margin: 0px; line-height: normal;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D""></user></span></div><div class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><br = class=3D""></span></div></div><div class=3D"">My admin domain = authentication looks OK:</div><div class=3D""><div style=3D"margin: 0px; = font-size: 11px; line-height: normal; font-family: Menlo;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">config.datasource.jdbcurl=3Djdbc:postgresql://pgdb:5432/ovirt_e= ngine?sslfactory=3Dorg.postgresql.ssl.NonValidatingFactory</span></div><di= v style=3D"margin: 0px; font-size: 11px; line-height: normal; = font-family: Menlo;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" = class=3D"">config.datasource.dbuser=3Dovirt</span></div><div = style=3D"margin: 0px; font-size: 11px; line-height: normal; font-family: = Menlo;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" = class=3D"">config.datasource.dbpassword=3DXXX</span></div><div = style=3D"margin: 0px; font-size: 11px; line-height: normal; font-family: = Menlo;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" = class=3D"">config.datasource.jdbcdriver=3Dorg.postgresql.Driver</span></di= v><div style=3D"margin: 0px; font-size: 11px; line-height: normal; = font-family: Menlo;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" = class=3D"">config.datasource.schemaname=3Daaa_jdbc</span></div></div><div = style=3D"margin: 0px; font-size: 11px; line-height: normal; font-family: = Menlo;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><br class=3D""></span></div><div = style=3D"margin: 0px; font-size: 11px; line-height: normal; font-family: = Menlo;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D"">It tried to = increase </span>org.ovirt.engine.core.sso.utils debug log level by = modifying = /usr/share/ovirt-engine/services/ovirt-engine/ovirt-engine.xml.in</div><di= v style=3D"margin: 0px; font-size: 11px; line-height: normal; = font-family: Menlo;" class=3D""><br class=3D""></div><div style=3D"margin:= 0px; font-size: 11px; line-height: normal; font-family: Menlo;" = class=3D""><div style=3D"margin: 0px; line-height: normal;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">diff ovirt-engine.xml.in*</span></div><div style=3D"margin: = 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">201,204d200</span></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D"">< <logger = category=3D"org.ovirt.engine.core.sso.utils"></span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D"">< = <level name=3D"ALL"/></span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D"">< = </logger></span></div><div style=3D"margin: = 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">< </span></div><div class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><br = class=3D""></span></div><div class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D"">I just = got in the log:</span></div><div class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">2017-06-28 17:17:09,404+02 DEBUG = [org.ovirt.engine.core.sso.utils.NonInteractiveAuth] (default task-7) [] = Performing Negotiate Auth</span></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D"">2017-06-28 17:17:09,404+02 DEBUG = [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-7) [] = Performing external authentication</span></div><div style=3D"margin: = 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">2017-06-28 17:17:09,410+02 ERROR = [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-7) [] = External Authentication Failed: Cannot resolve principal = 'rexecutor@internal'</span></div><div style=3D"margin: 0px; line-height: = normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D"">2017-06-28 17:17:09,410+02 DEBUG = [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-7) [] = External Authentication Failed: Class: class = org.ovirt.engine.core.extensions.mgr.ExtensionInvokeCommandFailedException= </span></div><div style=3D"margin: 0px; line-height: normal;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">Input:</span></div><div style=3D"margin: 0px; line-height: = normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" = class=3D"">{Extkey[name=3DEXTENSION_INVOKE_COMMAND;type=3Dclass = org.ovirt.engine.api.extensions.ExtUUID;uuid=3DEXTENSION_INVOKE_COMMAND[48= 5778ab-bede-4f1a-b823-77b262a2f28d];]=3DAAA_AUTHZ_FETCH_PRINCIPAL_RECORD[5= a5bf9bb-9336-4376-a823-26efe1ba26df], = Extkey[name=3DAAA_AUTHZ_QUERY_FLAGS;type=3Dclass = java.lang.Integer;uuid=3DAAA_AUTHZ_QUERY_FLAGS[97d226e9-8d87-49a0-9a7f-af6= 89320907b];]=3D3, Extkey[name=3DEXTENSION_INVOKE_CONTEXT;type=3Dclass = org.ovirt.engine.api.extensions.ExtMap;uuid=3DEXTENSION_INVOKE_CONTEXT[886= d2ebb-312a-49ae-9cc3-e1f849834b7d];]=3D{Extkey[name=3DAAA_AUTHZ_AVAILABLE_= NAMESPACES;type=3Dinterface = java.util.Collection;uuid=3DAAA_AUTHZ_AVAILABLE_NAMESPACES[6dffa34c-955f-4= 86a-bd35-0a272b45a711];]=3D[DC=3DXXX], = Extkey[name=3DEXTENSION_LICENSE;type=3Dclass = java.lang.String;uuid=3DEXTENSION_LICENSE[8a61ad65-054c-4e31-9c6d-1ca4d60a= 4c18];]=3DASL 2.0, Extkey[name=3DEXTENSION_GLOBAL_CONTEXT;type=3Dclass = org.ovirt.engine.api.extensions.ExtMap;uuid=3DEXTENSION_GLOBAL_CONTEXT[979= 9e72f-7af6-4cf1-bf08-297bc8903676];]=3D*skip*, = Extkey[name=3DEXTENSION_NAME;type=3Dclass = java.lang.String;uuid=3DEXTENSION_NAME[651381d3-f54f-4547-bf28-b0b01a10318= 4];]=3Dovirt-engine-extension-aaa-ldap.authz, = Extkey[name=3DEXTENSION_MANAGER_TRACE_LOG;type=3Dinterface = org.slf4j.Logger;uuid=3DEXTENSION_MANAGER_TRACE_LOG[863db666-3ea7-4751-969= 5-918a3197ad83];]=3Dorg.slf4j.impl.Slf4jLogger(org.ovirt.engine.core.exten= sions.mgr.ExtensionsManager.trace.ovirt-engine-extension-aaa-ldap.authz.XX= X-authz), = Extkey[name=3DEXTENSION_CONFIGURATION_SENSITIVE_KEYS;type=3Dinterface = java.util.Collection;uuid=3DEXTENSION_CONFIGURATION_SENSITIVE_KEYS[a456efa= 1-73ff-4204-9f9b-ebff01e35263];]=3D[], = Extkey[name=3DEXTENSION_VERSION;type=3Dclass = java.lang.String;uuid=3DEXTENSION_VERSION[fe35f6a8-8239-4bdb-ab1a-af9f779c= e68c];]=3D1.3.1, Extkey[name=3DEXTENSION_PROVIDES;type=3Dinterface = java.util.Collection;uuid=3DEXTENSION_PROVIDES[8cf373a6-65b5-4594-b828-0e2= 75087de91];]=3D[org.ovirt.engine.api.extensions.aaa.Authz], = Extkey[name=3DEXTENSION_AUTHOR;type=3Dclass = java.lang.String;uuid=3DEXTENSION_AUTHOR[ef242f7a-2dad-4bc5-9aad-e07018b7f= bcc];]=3DThe oVirt Project, Extkey[name=3DEXTENSION_LOCALE;type=3Dclass = java.lang.String;uuid=3DEXTENSION_LOCALE[0780b112-0ce0-404a-b85e-8765d778b= b29];]=3Den_US, Extkey[name=3DEXTENSION_CONFIGURATION_FILE;type=3Dclass = java.lang.String;uuid=3DEXTENSION_CONFIGURATION_FILE[4fb0ffd3-983c-4f3f-98= ff-9660bd67af6a];]=3D/etc/ovirt-engine/extensions.d/XXXX-authz.properties,= Extkey[name=3DEXTENSION_HOME_URL;type=3Dclass = java.lang.String;uuid=3DEXTENSION_HOME_URL[4ad7a2f4-f969-42d4-b399-72d192e= 18304];]=3D<a href=3D"http://www.ovirt.org" = class=3D"">http://www.ovirt.org</a>, = Extkey[name=3DEXTENSION_CONFIGURATION;type=3Dclass = java.util.Properties;uuid=3DEXTENSION_CONFIGURATION[2d48ab72-f0a1-4312-b4a= e-5068a226b0fc];]=3D***, = Extkey[name=3DEXTENSION_INTERFACE_VERSION_MAX;type=3Dclass = java.lang.Integer;uuid=3DEXTENSION_INTERFACE_VERSION_MAX[f4cff49f-2717-490= 1-8ee9-df362446e3e7];]=3D0, = Extkey[name=3DAAA_AUTHZ_QUERY_MAX_FILTER_SIZE;type=3Dclass = java.lang.Integer;uuid=3DAAA_AUTHZ_QUERY_MAX_FILTER_SIZE[2eb1f541-0f65-44a= 1-a6e3-014e247595f5];]=3D50, = Extkey[name=3DEXTENSION_INTERFACE_VERSION_MIN;type=3Dclass = java.lang.Integer;uuid=3DEXTENSION_INTERFACE_VERSION_MIN[2b84fc91-305b-497= b-a1d7-d961b9d2ce0b];]=3D0, = Extkey[name=3DEXTENSION_INSTANCE_NAME;type=3Dclass = java.lang.String;uuid=3DEXTENSION_INSTANCE_NAME[65c67ff6-aeca-4bd5-a245-86= 74327f011b];]=3DXXXX-authz, = Extkey[name=3DEXTENSION_BUILD_INTERFACE_VERSION;type=3Dclass = java.lang.Integer;uuid=3DEXTENSION_BUILD_INTERFACE_VERSION[cb479e5a-4b23-4= 6f8-aed3-56a4747a8ab7];]=3D0, Extkey[name=3DEXTENSION_NOTES;type=3Dclass = java.lang.String;uuid=3DEXTENSION_NOTES[2da5ad7e-185a-4584-aaff-97f66978e4= ea];]=3DDisplay name: = ovirt-engine-extension-aaa-ldap-1.3.1-1.el7.centos}, = Extkey[name=3DAAA_AUTHN_AUTH_RECORD;type=3Dclass = org.ovirt.engine.api.extensions.ExtMap;uuid=3DAAA_AUTHN_AUTH_RECORD[e94621= 68-b53b-44ac-9af5-f25e1697173e];]=3D{Extkey[name=3DAAA_AUTHN_AUTH_RECORD_P= RINCIPAL;type=3Dclass = java.lang.String;uuid=3DAAA_AUTHN_AUTH_RECORD_PRINCIPAL[c3498f07-11fe-464c= -958c-8bd7490b119a];]=3Drexecutor@internal}}</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">Output:</span></div><div style=3D"margin: 0px; line-height: = normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" = class=3D"">{Extkey[name=3DEXTENSION_INVOKE_MESSAGE;type=3Dclass = java.lang.String;uuid=3DEXTENSION_INVOKE_MESSAGE[b7b053de-dc73-4bf7-9d26-b= 8bdb72f5893];]=3DCannot resolve principal 'rexecutor@internal', = Extkey[name=3DEXTENSION_INVOKE_RESULT;type=3Dclass = java.lang.Integer;uuid=3DEXTENSION_INVOKE_RESULT[0909d91d-8bde-40fb-b6c0-0= 99c772ddd4e];]=3D2}</span></div><div style=3D"margin: 0px; line-height: = normal; min-height: 13px;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" = class=3D""></span><br class=3D""></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.= java:95) [extensions-manager.jar:]</span></div><div style=3D"margin: = 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.= java:109) [extensions-manager.jar:]</span></div><div style=3D"margin: = 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.sso.utils.NegotiateAuthUtils.doAuth(NegotiateAuthUti= ls.java:122) [enginesso.jar:]</span></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.sso.utils.NegotiateAuthUtils.doAuth(NegotiateAuthUti= ls.java:68) [enginesso.jar:]</span></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.sso.utils.NonInteractiveAuth$2.doAuth(NonInteractive= Auth.java:51) [enginesso.jar:]</span></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.issueTokenUsingHttpHe= aders(OAuthTokenServlet.java:183) [enginesso.jar:]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.service(OAuthTokenSer= vlet.java:72) [enginesso.jar:]</span></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = javax.servlet.http.HttpServlet.service(HttpServlet.java:790) = [jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.j= ava:85) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:129) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.branding.BrandingFilter.doFilter(BrandingFilter.java= :73) [branding.jar:]</span></div><div style=3D"margin: 0px; line-height: = normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:131) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.utils.servlet.LocaleFilter.doFilter(LocaleFilter.jav= a:66) [utils.jar:]</span></div><div style=3D"margin: 0px; line-height: = normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:131) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.utils.servlet.HeaderFilter.doFilter(HeaderFilter.jav= a:94) [utils.jar:]</span></div><div style=3D"margin: 0px; line-height: = normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:131) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.jav= a:84) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleReq= uest(ServletSecurityRoleHandler.java:62) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(Servl= etDispatchingHandler.java:36) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.= handleRequest(SecurityContextAssociationHandler.java:78)</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.han= dleRequest(SSLInformationAssociationHandler.java:131) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.han= dleRequest(ServletAuthenticationCallHandler.java:57) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.security.handlers.AuthenticationConstraintHandler.handleReques= t(AuthenticationConstraintHandler.java:53) = [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest= (AbstractConfidentialityHandler.java:46) = [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHand= ler.handleRequest(ServletConfidentialityConstraintHandler.java:64) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.han= dleRequest(ServletSecurityConstraintHandler.java:59) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.security.handlers.AuthenticationMechanismsHandler.handleReques= t(AuthenticationMechanismsHandler.java:60) = [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.ha= ndleRequest(CachedAuthenticatedSessionHandler.java:77) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(No= tificationReceiverHandler.java:50) = [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.ha= ndleRequest(AbstractSecurityContextAssociationHandler.java:43) = [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRe= quest(JACCContextIdHandler.java:61)</span></div><div style=3D"margin: = 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(Serv= letInitialHandler.java:292) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletIniti= alHandler.java:81) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHa= ndler.java:138) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHa= ndler.java:135) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(Ser= vletRequestContextThreadSetupAction.java:48) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClass= LoaderSetupAction.java:43) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(Servlet= InitialHandler.java:272) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletIniti= alHandler.java:81) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(Servlet= InitialHandler.java:104) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) = [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:805) = [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:= 1142) [rt.jar:1.8.0_121]</span></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java= :617) [rt.jar:1.8.0_121]</span></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = java.lang.Thread.run(Thread.java:745) = [rt.jar:1.8.0_121]</span></div><div style=3D"margin: 0px; line-height: = normal; min-height: 13px;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" = class=3D""></span><br class=3D""></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D"">2017-06-28 17:17:09,414+02 DEBUG = [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-7) [] = External Authentication result: false</span></div><div style=3D"margin: = 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">2017-06-28 17:17:09,414+02 ERROR = [org.ovirt.engine.core.sso.utils.SsoUtils] (default task-7) [] = OAuthException access_denied: Cannot authenticate user Authentication = failed..</span></div><div style=3D"margin: 0px; line-height: normal;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">2017-06-28 17:17:09,414+02 DEBUG = [org.ovirt.engine.core.sso.utils.SsoUtils] (default task-7) [] = Exception: org.ovirt.engine.core.sso.utils.OAuthException: Cannot = authenticate user Authentication failed..</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.sso.utils.SsoUtils.sendJsonDataWithMessage(SsoUtils.= java:569) [enginesso.jar:]</span></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.service(OAuthTokenSer= vlet.java:81) [enginesso.jar:]</span></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = javax.servlet.http.HttpServlet.service(HttpServlet.java:790) = [jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.j= ava:85) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:129) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.branding.BrandingFilter.doFilter(BrandingFilter.java= :73) [branding.jar:]</span></div><div style=3D"margin: 0px; line-height: = normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:131) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.utils.servlet.LocaleFilter.doFilter(LocaleFilter.jav= a:66) [utils.jar:]</span></div><div style=3D"margin: 0px; line-height: = normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:131) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.utils.servlet.HeaderFilter.doFilter(HeaderFilter.jav= a:94) [utils.jar:]</span></div><div style=3D"margin: 0px; line-height: = normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(Filter= Handler.java:131) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.jav= a:84) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleReq= uest(ServletSecurityRoleHandler.java:62) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(Servl= etDispatchingHandler.java:36) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.= handleRequest(SecurityContextAssociationHandler.java:78)</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.han= dleRequest(SSLInformationAssociationHandler.java:131) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.han= dleRequest(ServletAuthenticationCallHandler.java:57) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.security.handlers.AuthenticationConstraintHandler.handleReques= t(AuthenticationConstraintHandler.java:53) = [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest= (AbstractConfidentialityHandler.java:46) = [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHand= ler.handleRequest(ServletConfidentialityConstraintHandler.java:64) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.han= dleRequest(ServletSecurityConstraintHandler.java:59) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.security.handlers.AuthenticationMechanismsHandler.handleReques= t(AuthenticationMechanismsHandler.java:60) = [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.ha= ndleRequest(CachedAuthenticatedSessionHandler.java:77) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(No= tificationReceiverHandler.java:50) = [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.ha= ndleRequest(AbstractSecurityContextAssociationHandler.java:43) = [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRe= quest(JACCContextIdHandler.java:61)</span></div><div style=3D"margin: = 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandle= r.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(Serv= letInitialHandler.java:292) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletIniti= alHandler.java:81) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHa= ndler.java:138) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHa= ndler.java:135) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(Ser= vletRequestContextThreadSetupAction.java:48) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClass= LoaderSetupAction.java:43) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThread= SetupActionWrapper.java:44) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(Servlet= InitialHandler.java:272) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletIniti= alHandler.java:81) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(Servlet= InitialHandler.java:104) = [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) = [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:805) = [undertow-core-1.4.0.Final.jar:1.4.0.Final]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:= 1142) [rt.jar:1.8.0_121]</span></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java= :617) [rt.jar:1.8.0_121]</span></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>at = java.lang.Thread.run(Thread.java:745) = [rt.jar:1.8.0_121]</span></div><div style=3D"margin: 0px; line-height: = normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D"">Caused by: = org.ovirt.engine.core.sso.utils.AuthenticationException: Cannot = authenticate user Authentication failed..</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.issueTokenUsingHttpHe= aders(OAuthTokenServlet.java:214) [enginesso.jar:]</span></div><div = style=3D"margin: 0px; line-height: normal;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>at = org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.service(OAuthTokenSer= vlet.java:72) [enginesso.jar:]</span></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>... 50 more</span></div><div = style=3D"margin: 0px; line-height: normal; min-height: 13px;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D""></span><br class=3D""></div><div style=3D"margin: 0px; = line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: = no-common-ligatures" class=3D"">2017-06-28 17:17:09,419+02 TRACE = [org.ovirt.engine.core.sso.utils.SsoUtils] (default task-7) [] Sending = json data {"error_code":"access_denied","error":"Cannot authenticate = user Authentication failed.."}</span></div></span></div></div><div = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D""><br class=3D""></span></div><div class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><br = class=3D""></span></div></span></div></div></body></html>= --Apple-Mail=_B78E14EB-413D-4DC1-AC54-F837E05B2CF8--

How do you login? Do you use webadmin or API/SDK, if using SDK, don't you use kerberos=True? On Wed, Jun 28, 2017 at 5:21 PM, Fabrice Bacchella <fabrice.bacchella@orange.fr> wrote:
I tried to add a user in ovirt, but it's not identified: 2017-06-28 16:48:48,505+02 ERROR [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-22) [] External Authentication Failed: Cannot resolve principal 'rexecutor@internal'
/usr/bin/ovirt-aaa-jdbc-tool user show rexecutor -- User rexecutor(b1727291-5ad4-4575-b8ec-53bdc9ce4aef) -- Namespace: * Name: rexecutor ID: b1727291-5ad4-4575-b8ec-53bdc9ce4aef Display Name: Email: First Name: Last Name: Department: Title: Description: Account Disabled: false Account Locked: false Account Unlocked At: 2017-06-16 13:49:31Z Account Valid From: 2017-06-15 16:41:14Z Account Valid To: 2217-06-15 16:41:14Z Account Without Password: true Last successful Login At: 1970-01-01 00:00:00Z Last unsuccessful Login At: 1970-01-01 00:00:00Z Password Valid To: 2025-08-15 10:30:00Z
It's listed as a known user: <user href="/ovirt-engine/api/users/49a12b6e-de03-4095-b6ed-2c1883f5542e" id="49a12b6e-de03-4095-b6ed-2c1883f5542e"> <department></department>
<domain_entry_id>62313732373239312D356164342D343537352D623865632D353362646339636534616566</domain_entry_id> <email></email> <last_name></last_name> <name></name> <namespace>*</namespace> <principal>rexecutor</principal> <user_name>rexecutor@internal-authz</user_name> <domain href="/ovirt-engine/api/domains/696E7465726E616C2D617574687A" id="696E7465726E616C2D617574687A"> <name>internal-authz</name> </domain> <permissions href="/ovirt-engine/api/users/49a12b6e-de03-4095-b6ed-2c1883f5542e/permissions"/> <roles href="/ovirt-engine/api/users/49a12b6e-de03-4095-b6ed-2c1883f5542e/roles"/> <ssh_public_keys href="/ovirt-engine/api/users/49a12b6e-de03-4095-b6ed-2c1883f5542e/sshpublickeys"/> <tags href="/ovirt-engine/api/users/49a12b6e-de03-4095-b6ed-2c1883f5542e/tags"/> </user>
My admin domain authentication looks OK: config.datasource.jdbcurl=jdbc:postgresql://pgdb:5432/ovirt_engine?sslfactory=org.postgresql.ssl.NonValidatingFactory config.datasource.dbuser=ovirt config.datasource.dbpassword=XXX config.datasource.jdbcdriver=org.postgresql.Driver config.datasource.schemaname=aaa_jdbc
It tried to increase org.ovirt.engine.core.sso.utils debug log level by modifying /usr/share/ovirt-engine/services/ovirt-engine/ovirt-engine.xml.in
diff ovirt-engine.xml.in* 201,204d200 < <logger category="org.ovirt.engine.core.sso.utils"> < <level name="ALL"/> < </logger> <
I just got in the log: 2017-06-28 17:17:09,404+02 DEBUG [org.ovirt.engine.core.sso.utils.NonInteractiveAuth] (default task-7) [] Performing Negotiate Auth 2017-06-28 17:17:09,404+02 DEBUG [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-7) [] Performing external authentication 2017-06-28 17:17:09,410+02 ERROR [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-7) [] External Authentication Failed: Cannot resolve principal 'rexecutor@internal' 2017-06-28 17:17:09,410+02 DEBUG [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-7) [] External Authentication Failed: Class: class org.ovirt.engine.core.extensions.mgr.ExtensionInvokeCommandFailedException Input: {Extkey[name=EXTENSION_INVOKE_COMMAND;type=class org.ovirt.engine.api.extensions.ExtUUID;uuid=EXTENSION_INVOKE_COMMAND[485778ab-bede-4f1a-b823-77b262a2f28d];]=AAA_AUTHZ_FETCH_PRINCIPAL_RECORD[5a5bf9bb-9336-4376-a823-26efe1ba26df], Extkey[name=AAA_AUTHZ_QUERY_FLAGS;type=class java.lang.Integer;uuid=AAA_AUTHZ_QUERY_FLAGS[97d226e9-8d87-49a0-9a7f-af689320907b];]=3, Extkey[name=EXTENSION_INVOKE_CONTEXT;type=class org.ovirt.engine.api.extensions.ExtMap;uuid=EXTENSION_INVOKE_CONTEXT[886d2ebb-312a-49ae-9cc3-e1f849834b7d];]={Extkey[name=AAA_AUTHZ_AVAILABLE_NAMESPACES;type=interface java.util.Collection;uuid=AAA_AUTHZ_AVAILABLE_NAMESPACES[6dffa34c-955f-486a-bd35-0a272b45a711];]=[DC=XXX], Extkey[name=EXTENSION_LICENSE;type=class java.lang.String;uuid=EXTENSION_LICENSE[8a61ad65-054c-4e31-9c6d-1ca4d60a4c18];]=ASL 2.0, Extkey[name=EXTENSION_GLOBAL_CONTEXT;type=class org.ovirt.engine.api.extensions.ExtMap;uuid=EXTENSION_GLOBAL_CONTEXT[9799e72f-7af6-4cf1-bf08-297bc8903676];]=*skip*, Extkey[name=EXTENSION_NAME;type=class java.lang.String;uuid=EXTENSION_NAME[651381d3-f54f-4547-bf28-b0b01a103184];]=ovirt-engine-extension-aaa-ldap.authz, Extkey[name=EXTENSION_MANAGER_TRACE_LOG;type=interface org.slf4j.Logger;uuid=EXTENSION_MANAGER_TRACE_LOG[863db666-3ea7-4751-9695-918a3197ad83];]=org.slf4j.impl.Slf4jLogger(org.ovirt.engine.core.extensions.mgr.ExtensionsManager.trace.ovirt-engine-extension-aaa-ldap.authz.XXX-authz), Extkey[name=EXTENSION_CONFIGURATION_SENSITIVE_KEYS;type=interface java.util.Collection;uuid=EXTENSION_CONFIGURATION_SENSITIVE_KEYS[a456efa1-73ff-4204-9f9b-ebff01e35263];]=[], Extkey[name=EXTENSION_VERSION;type=class java.lang.String;uuid=EXTENSION_VERSION[fe35f6a8-8239-4bdb-ab1a-af9f779ce68c];]=1.3.1, Extkey[name=EXTENSION_PROVIDES;type=interface java.util.Collection;uuid=EXTENSION_PROVIDES[8cf373a6-65b5-4594-b828-0e275087de91];]=[org.ovirt.engine.api.extensions.aaa.Authz], Extkey[name=EXTENSION_AUTHOR;type=class java.lang.String;uuid=EXTENSION_AUTHOR[ef242f7a-2dad-4bc5-9aad-e07018b7fbcc];]=The oVirt Project, Extkey[name=EXTENSION_LOCALE;type=class java.lang.String;uuid=EXTENSION_LOCALE[0780b112-0ce0-404a-b85e-8765d778bb29];]=en_US, Extkey[name=EXTENSION_CONFIGURATION_FILE;type=class java.lang.String;uuid=EXTENSION_CONFIGURATION_FILE[4fb0ffd3-983c-4f3f-98ff-9660bd67af6a];]=/etc/ovirt-engine/extensions.d/XXXX-authz.properties, Extkey[name=EXTENSION_HOME_URL;type=class java.lang.String;uuid=EXTENSION_HOME_URL[4ad7a2f4-f969-42d4-b399-72d192e18304];]=http://www.ovirt.org, Extkey[name=EXTENSION_CONFIGURATION;type=class java.util.Properties;uuid=EXTENSION_CONFIGURATION[2d48ab72-f0a1-4312-b4ae-5068a226b0fc];]=***, Extkey[name=EXTENSION_INTERFACE_VERSION_MAX;type=class java.lang.Integer;uuid=EXTENSION_INTERFACE_VERSION_MAX[f4cff49f-2717-4901-8ee9-df362446e3e7];]=0, Extkey[name=AAA_AUTHZ_QUERY_MAX_FILTER_SIZE;type=class java.lang.Integer;uuid=AAA_AUTHZ_QUERY_MAX_FILTER_SIZE[2eb1f541-0f65-44a1-a6e3-014e247595f5];]=50, Extkey[name=EXTENSION_INTERFACE_VERSION_MIN;type=class java.lang.Integer;uuid=EXTENSION_INTERFACE_VERSION_MIN[2b84fc91-305b-497b-a1d7-d961b9d2ce0b];]=0, Extkey[name=EXTENSION_INSTANCE_NAME;type=class java.lang.String;uuid=EXTENSION_INSTANCE_NAME[65c67ff6-aeca-4bd5-a245-8674327f011b];]=XXXX-authz, Extkey[name=EXTENSION_BUILD_INTERFACE_VERSION;type=class java.lang.Integer;uuid=EXTENSION_BUILD_INTERFACE_VERSION[cb479e5a-4b23-46f8-aed3-56a4747a8ab7];]=0, Extkey[name=EXTENSION_NOTES;type=class java.lang.String;uuid=EXTENSION_NOTES[2da5ad7e-185a-4584-aaff-97f66978e4ea];]=Display name: ovirt-engine-extension-aaa-ldap-1.3.1-1.el7.centos}, Extkey[name=AAA_AUTHN_AUTH_RECORD;type=class org.ovirt.engine.api.extensions.ExtMap;uuid=AAA_AUTHN_AUTH_RECORD[e9462168-b53b-44ac-9af5-f25e1697173e];]={Extkey[name=AAA_AUTHN_AUTH_RECORD_PRINCIPAL;type=class java.lang.String;uuid=AAA_AUTHN_AUTH_RECORD_PRINCIPAL[c3498f07-11fe-464c-958c-8bd7490b119a];]=rexecutor@internal}} Output: {Extkey[name=EXTENSION_INVOKE_MESSAGE;type=class java.lang.String;uuid=EXTENSION_INVOKE_MESSAGE[b7b053de-dc73-4bf7-9d26-b8bdb72f5893];]=Cannot resolve principal 'rexecutor@internal', Extkey[name=EXTENSION_INVOKE_RESULT;type=class java.lang.Integer;uuid=EXTENSION_INVOKE_RESULT[0909d91d-8bde-40fb-b6c0-099c772ddd4e];]=2}
at org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.java:95) [extensions-manager.jar:] at org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.java:109) [extensions-manager.jar:] at org.ovirt.engine.core.sso.utils.NegotiateAuthUtils.doAuth(NegotiateAuthUtils.java:122) [enginesso.jar:] at org.ovirt.engine.core.sso.utils.NegotiateAuthUtils.doAuth(NegotiateAuthUtils.java:68) [enginesso.jar:] at org.ovirt.engine.core.sso.utils.NonInteractiveAuth$2.doAuth(NonInteractiveAuth.java:51) [enginesso.jar:] at org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.issueTokenUsingHttpHeaders(OAuthTokenServlet.java:183) [enginesso.jar:] at org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.service(OAuthTokenServlet.java:72) [enginesso.jar:] at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) [jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final] at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at org.ovirt.engine.core.branding.BrandingFilter.doFilter(BrandingFilter.java:73) [branding.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at org.ovirt.engine.core.utils.servlet.LocaleFilter.doFilter(LocaleFilter.java:66) [utils.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at org.ovirt.engine.core.utils.servlet.HeaderFilter.doFilter(HeaderFilter.java:94) [utils.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:53) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:59) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:805) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_121] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_121] at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_121]
2017-06-28 17:17:09,414+02 DEBUG [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-7) [] External Authentication result: false 2017-06-28 17:17:09,414+02 ERROR [org.ovirt.engine.core.sso.utils.SsoUtils] (default task-7) [] OAuthException access_denied: Cannot authenticate user Authentication failed.. 2017-06-28 17:17:09,414+02 DEBUG [org.ovirt.engine.core.sso.utils.SsoUtils] (default task-7) [] Exception: org.ovirt.engine.core.sso.utils.OAuthException: Cannot authenticate user Authentication failed.. at org.ovirt.engine.core.sso.utils.SsoUtils.sendJsonDataWithMessage(SsoUtils.java:569) [enginesso.jar:] at org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.service(OAuthTokenServlet.java:81) [enginesso.jar:] at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) [jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final] at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at org.ovirt.engine.core.branding.BrandingFilter.doFilter(BrandingFilter.java:73) [branding.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at org.ovirt.engine.core.utils.servlet.LocaleFilter.doFilter(LocaleFilter.java:66) [utils.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at org.ovirt.engine.core.utils.servlet.HeaderFilter.doFilter(HeaderFilter.java:94) [utils.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:53) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:59) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104) [undertow-servlet-1.4.0.Final.jar:1.4.0.Final] at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:805) [undertow-core-1.4.0.Final.jar:1.4.0.Final] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_121] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_121] at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_121] Caused by: org.ovirt.engine.core.sso.utils.AuthenticationException: Cannot authenticate user Authentication failed.. at org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.issueTokenUsingHttpHeaders(OAuthTokenServlet.java:214) [enginesso.jar:] at org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.service(OAuthTokenServlet.java:72) [enginesso.jar:] ... 50 more
2017-06-28 17:17:09,419+02 TRACE [org.ovirt.engine.core.sso.utils.SsoUtils] (default task-7) [] Sending json data {"error_code":"access_denied","error":"Cannot authenticate user Authentication failed.."}
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users

Le 29 juin 2017 à 13:41, Ondra Machacek <omachace@redhat.com> a écrit :
How do you login? Do you use webadmin or API/SDK, if using SDK, don't you use kerberos=True?
Ok, got it. It's tested with the sdk, using kerberos. But Kerberos authentication is done in Apache and I configure a profile for that, so I needed to add: config.artifact.arg = X-Remote-User in my /etc/ovirt-engine/extensions.d/MyProfile.authn.properties. But this is missing from internal-authn.properties. So rexecutor@internal is checked with my profil, and not found. But as the internal profil don't know about X-Remote-User, it can't check the user and fails silently. That's why I'm getting only one line. Perhaps the log line should have said the extensions name that was failing, not the generic "External Authentication" that did'nt caught my eye. I will check that as soon as I have a few minutes to spare and tell you.

Le 29 juin 2017 à 14:42, Fabrice Bacchella <fabrice.bacchella@orange.fr> a écrit :
Le 29 juin 2017 à 13:41, Ondra Machacek <omachace@redhat.com> a écrit :
How do you login? Do you use webadmin or API/SDK, if using SDK, don't you use kerberos=True?
Ok, got it. It's tested with the sdk, using kerberos. But Kerberos authentication is done in Apache and I configure a profile for that, so I needed to add: config.artifact.arg = X-Remote-User in my /etc/ovirt-engine/extensions.d/MyProfile.authn.properties. But this is missing from internal-authn.properties. So rexecutor@internal is checked with my profil, and not found. But as the internal profil don't know about X-Remote-User, it can't check the user and fails silently. That's why I'm getting only one line. Perhaps the log line should have said the extensions name that was failing, not the generic "External Authentication" that did'nt caught my eye.
I will check that as soon as I have a few minutes to spare and tell you.
I'm starting to understand. I need two authn modules, both using org.ovirt.engineextensions.aaa.misc.http.AuthnExtension but with a different authz.plugin. Is that possible ? If I do what, in what order the different Authn will be tried ? Are they all tried until one succeed both authn and authz ?

On Thu, Jun 29, 2017 at 5:16 PM, Fabrice Bacchella <fabrice.bacchella@orange.fr> wrote:
Le 29 juin 2017 à 14:42, Fabrice Bacchella <fabrice.bacchella@orange.fr> a écrit :
Le 29 juin 2017 à 13:41, Ondra Machacek <omachace@redhat.com> a écrit :
How do you login? Do you use webadmin or API/SDK, if using SDK, don't you use kerberos=True?
Ok, got it. It's tested with the sdk, using kerberos. But Kerberos authentication is done in Apache and I configure a profile for that, so I needed to add: config.artifact.arg = X-Remote-User in my /etc/ovirt-engine/extensions.d/MyProfile.authn.properties. But this is missing from internal-authn.properties. So rexecutor@internal is checked with my profil, and not found. But as the internal profil don't know about X-Remote-User, it can't check the user and fails silently. That's why I'm getting only one line. Perhaps the log line should have said the extensions name that was failing, not the generic "External Authentication" that did'nt caught my eye.
I will check that as soon as I have a few minutes to spare and tell you.
I'm starting to understand. I need two authn modules, both using org.ovirt.engineextensions.aaa.misc.http.AuthnExtension but with a different authz.plugin. Is that possible ? If I do what, in what order the different Authn will be tried ? Are they all tried until one succeed both authn and authz ?
Yes you can have multiple authn profiles and it tries to login until one succeed: https://github.com/oVirt/ovirt-engine/blob/de46aa78f3117cbe436ab10926ac0c23f... The order isn't guaranteed, but I think it's not important, or is it for you?

Le 30 juin 2017 à 23:25, Ondra Machacek <omachace@redhat.com> a écrit :
On Thu, Jun 29, 2017 at 5:16 PM, Fabrice Bacchella <fabrice.bacchella@orange.fr> wrote:
Le 29 juin 2017 à 14:42, Fabrice Bacchella <fabrice.bacchella@orange.fr> a écrit :
Le 29 juin 2017 à 13:41, Ondra Machacek <omachace@redhat.com> a écrit :
How do you login? Do you use webadmin or API/SDK, if using SDK, don't you use kerberos=True?
Ok, got it. It's tested with the sdk, using kerberos. But Kerberos authentication is done in Apache and I configure a profile for that, so I needed to add: config.artifact.arg = X-Remote-User in my /etc/ovirt-engine/extensions.d/MyProfile.authn.properties. But this is missing from internal-authn.properties. So rexecutor@internal is checked with my profil, and not found. But as the internal profil don't know about X-Remote-User, it can't check the user and fails silently. That's why I'm getting only one line. Perhaps the log line should have said the extensions name that was failing, not the generic "External Authentication" that did'nt caught my eye.
I will check that as soon as I have a few minutes to spare and tell you.
I'm starting to understand. I need two authn modules, both using org.ovirt.engineextensions.aaa.misc.http.AuthnExtension but with a different authz.plugin. Is that possible ? If I do what, in what order the different Authn will be tried ? Are they all tried until one succeed both authn and authz ?
Yes you can have multiple authn profiles and it tries to login until one succeed:
https://github.com/oVirt/ovirt-engine/blob/de46aa78f3117cbe436ab10926ac0c23f...
The order isn't guaranteed, but I think it's not important, or is it for you?
I'm not sure. As I need two org.ovirt.engineextensions.aaa.misc.http.AuthnExtension, the authentication will always succeed. It's the auhtz that fails as user as either in one backend or the other. So if ExtMap output = profile.getAuthn().invoke(..) calls the authz part I will be fine.

Le 1 juil. 2017 à 09:09, Fabrice Bacchella <fabrice.bacchella@orange.fr> a écrit :
Le 30 juin 2017 à 23:25, Ondra Machacek <omachace@redhat.com> a écrit :
On Thu, Jun 29, 2017 at 5:16 PM, Fabrice Bacchella <fabrice.bacchella@orange.fr> wrote:
Le 29 juin 2017 à 14:42, Fabrice Bacchella <fabrice.bacchella@orange.fr> a écrit :
Le 29 juin 2017 à 13:41, Ondra Machacek <omachace@redhat.com> a écrit :
How do you login? Do you use webadmin or API/SDK, if using SDK, don't you use kerberos=True?
Ok, got it. It's tested with the sdk, using kerberos. But Kerberos authentication is done in Apache and I configure a profile for that, so I needed to add: config.artifact.arg = X-Remote-User in my /etc/ovirt-engine/extensions.d/MyProfile.authn.properties. But this is missing from internal-authn.properties. So rexecutor@internal is checked with my profil, and not found. But as the internal profil don't know about X-Remote-User, it can't check the user and fails silently. That's why I'm getting only one line. Perhaps the log line should have said the extensions name that was failing, not the generic "External Authentication" that did'nt caught my eye.
I will check that as soon as I have a few minutes to spare and tell you.
I'm starting to understand. I need two authn modules, both using org.ovirt.engineextensions.aaa.misc.http.AuthnExtension but with a different authz.plugin. Is that possible ? If I do what, in what order the different Authn will be tried ? Are they all tried until one succeed both authn and authz ?
Yes you can have multiple authn profiles and it tries to login until one succeed:
https://github.com/oVirt/ovirt-engine/blob/de46aa78f3117cbe436ab10926ac0c23f...
The order isn't guaranteed, but I think it's not important, or is it for you?
I'm not sure. As I need two org.ovirt.engineextensions.aaa.misc.http.AuthnExtension, the authentication will always succeed. It's the auhtz that fails as user as either in one backend or the other. So if ExtMap output = profile.getAuthn().invoke(..) calls the authz part I will be fine.
I think it's not possible to have 2 org.ovirt.engineextensions.aaa.misc.http.AuthnExtension with different authz. The first authz ldap based backend is tried and return: 2017-07-04 17:50:25,711+02 DEBUG [org.ovirt.engineextensions.aaa.ldap.AuthzExtension] (default task-2) [] Exception: java.lang.RuntimeException: Cannot resolve principal 'rexecutor' at org.ovirt.engineextensions.aaa.ldap.AuthzExtension.doFetchPrincipalRecord(AuthzExtension.java:579) [ovirt-engine-extension-aaa-ldap.jar:] at org.ovirt.engineextensions.aaa.ldap.AuthzExtension.invoke(AuthzExtension.java:478) [ovirt-engine-extension-aaa-ldap.jar:] at org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.java:49) at org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.java:73) at org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.java:109) at org.ovirt.engine.core.sso.utils.NegotiateAuthUtils.doAuth(NegotiateAuthUtils.java:122) at org.ovirt.engine.core.sso.utils.NegotiateAuthUtils.doAuth(NegotiateAuthUtils.java:68) at org.ovirt.engine.core.sso.utils.NonInteractiveAuth$2.doAuth(NonInteractiveAuth.java:51) at org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.issueTokenUsingHttpHeaders(OAuthTokenServlet.java:183) at org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.service(OAuthTokenServlet.java:72) at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) at org.ovirt.engine.core.branding.BrandingFilter.doFilter(BrandingFilter.java:73) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at org.ovirt.engine.core.utils.servlet.LocaleFilter.doFilter(LocaleFilter.java:66) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at org.ovirt.engine.core.utils.servlet.HeaderFilter.doFilter(HeaderFilter.java:94) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:53) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) at io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:59) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292) at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:805) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_121] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_121] at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_121] Right after that, I see in the log: 2017-07-04 17:50:25,718+02 ERROR [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-2) [] External Authentication Failed: Cannot resolve principal 'rexecutor' and I don't see in the stack the modules you show me in org.ovirt.engine.core.aaa.filters.doAuth, I think the failure happens latter and ovirt won't manage to handle other authn modules.

On Tue, Jul 4, 2017 at 6:05 PM, Fabrice Bacchella <fabrice.bacchella@orange.fr> wrote:
Le 1 juil. 2017 à 09:09, Fabrice Bacchella <fabrice.bacchella@orange.fr> a écrit :
Le 30 juin 2017 à 23:25, Ondra Machacek <omachace@redhat.com> a écrit :
On Thu, Jun 29, 2017 at 5:16 PM, Fabrice Bacchella <fabrice.bacchella@orange.fr> wrote:
Le 29 juin 2017 à 14:42, Fabrice Bacchella <fabrice.bacchella@orange.fr> a écrit :
Le 29 juin 2017 à 13:41, Ondra Machacek <omachace@redhat.com> a écrit :
How do you login? Do you use webadmin or API/SDK, if using SDK, don't you use kerberos=True?
Ok, got it. It's tested with the sdk, using kerberos. But Kerberos authentication is done in Apache and I configure a profile for that, so I needed to add: config.artifact.arg = X-Remote-User in my /etc/ovirt-engine/extensions.d/MyProfile.authn.properties. But this is missing from internal-authn.properties. So rexecutor@internal is checked with my profil, and not found. But as the internal profil don't know about X-Remote-User, it can't check the user and fails silently. That's why I'm getting only one line. Perhaps the log line should have said the extensions name that was failing, not the generic "External Authentication" that did'nt caught my eye.
I will check that as soon as I have a few minutes to spare and tell you.
I'm starting to understand. I need two authn modules, both using org.ovirt.engineextensions.aaa.misc.http.AuthnExtension but with a different authz.plugin. Is that possible ? If I do what, in what order the different Authn will be tried ? Are they all tried until one succeed both authn and authz ?
Yes you can have multiple authn profiles and it tries to login until one succeed:
https://github.com/oVirt/ovirt-engine/blob/de46aa78f3117cbe436ab10926ac0c23f...
The order isn't guaranteed, but I think it's not important, or is it for you?
I'm not sure. As I need two org.ovirt.engineextensions.aaa.misc.http.AuthnExtension, the authentication will always succeed. It's the auhtz that fails as user as either in one backend or the other. So if ExtMap output = profile.getAuthn().invoke(..) calls the authz part I will be fine.
I think it's not possible to have 2 org.ovirt.engineextensions.aaa.misc.http.AuthnExtension with different authz.
The first authz ldap based backend is tried and return: 2017-07-04 17:50:25,711+02 DEBUG [org.ovirt.engineextensions.aaa.ldap.AuthzExtension] (default task-2) [] Exception: java.lang.RuntimeException: Cannot resolve principal 'rexecutor' at org.ovirt.engineextensions.aaa.ldap.AuthzExtension.doFetchPrincipalRecord(AuthzExtension.java:579) [ovirt-engine-extension-aaa-ldap.jar:] at org.ovirt.engineextensions.aaa.ldap.AuthzExtension.invoke(AuthzExtension.java:478) [ovirt-engine-extension-aaa-ldap.jar:] at org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.java:49) at org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.java:73) at org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.java:109) at org.ovirt.engine.core.sso.utils.NegotiateAuthUtils.doAuth(NegotiateAuthUtils.java:122) at org.ovirt.engine.core.sso.utils.NegotiateAuthUtils.doAuth(NegotiateAuthUtils.java:68) at org.ovirt.engine.core.sso.utils.NonInteractiveAuth$2.doAuth(NonInteractiveAuth.java:51) at org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.issueTokenUsingHttpHeaders(OAuthTokenServlet.java:183) at org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.service(OAuthTokenServlet.java:72) at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) at org.ovirt.engine.core.branding.BrandingFilter.doFilter(BrandingFilter.java:73) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at org.ovirt.engine.core.utils.servlet.LocaleFilter.doFilter(LocaleFilter.java:66) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at org.ovirt.engine.core.utils.servlet.HeaderFilter.doFilter(HeaderFilter.java:94) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:53) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) at io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:59) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292) at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:805) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_121] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_121] at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_121]
Right after that, I see in the log: 2017-07-04 17:50:25,718+02 ERROR [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-2) [] External Authentication Failed: Cannot resolve principal 'rexecutor'
and I don't see in the stack the modules you show me in org.ovirt.engine.core.aaa.filters.doAuth, I think the failure happens latter and ovirt won't manage to handle other authn modules.
Ok, that's bug, can you please open it?

Ok.
Le 7 juil. 2017 à 13:51, Ondra Machacek <omachace@redhat.com> a écrit :
On Tue, Jul 4, 2017 at 6:05 PM, Fabrice Bacchella <fabrice.bacchella@orange.fr> wrote:
Le 1 juil. 2017 à 09:09, Fabrice Bacchella <fabrice.bacchella@orange.fr> a écrit :
Le 30 juin 2017 à 23:25, Ondra Machacek <omachace@redhat.com> a écrit :
On Thu, Jun 29, 2017 at 5:16 PM, Fabrice Bacchella <fabrice.bacchella@orange.fr> wrote:
Le 29 juin 2017 à 14:42, Fabrice Bacchella <fabrice.bacchella@orange.fr> a écrit :
> Le 29 juin 2017 à 13:41, Ondra Machacek <omachace@redhat.com> a écrit : > > How do you login? Do you use webadmin or API/SDK, if using SDK, don't > you use kerberos=True?
Ok, got it. It's tested with the sdk, using kerberos. But Kerberos authentication is done in Apache and I configure a profile for that, so I needed to add: config.artifact.arg = X-Remote-User in my /etc/ovirt-engine/extensions.d/MyProfile.authn.properties. But this is missing from internal-authn.properties. So rexecutor@internal is checked with my profil, and not found. But as the internal profil don't know about X-Remote-User, it can't check the user and fails silently. That's why I'm getting only one line. Perhaps the log line should have said the extensions name that was failing, not the generic "External Authentication" that did'nt caught my eye.
I will check that as soon as I have a few minutes to spare and tell you.
I'm starting to understand. I need two authn modules, both using org.ovirt.engineextensions.aaa.misc.http.AuthnExtension but with a different authz.plugin. Is that possible ? If I do what, in what order the different Authn will be tried ? Are they all tried until one succeed both authn and authz ?
Yes you can have multiple authn profiles and it tries to login until one succeed:
https://github.com/oVirt/ovirt-engine/blob/de46aa78f3117cbe436ab10926ac0c23f...
The order isn't guaranteed, but I think it's not important, or is it for you?
I'm not sure. As I need two org.ovirt.engineextensions.aaa.misc.http.AuthnExtension, the authentication will always succeed. It's the auhtz that fails as user as either in one backend or the other. So if ExtMap output = profile.getAuthn().invoke(..) calls the authz part I will be fine.
I think it's not possible to have 2 org.ovirt.engineextensions.aaa.misc.http.AuthnExtension with different authz.
The first authz ldap based backend is tried and return: 2017-07-04 17:50:25,711+02 DEBUG [org.ovirt.engineextensions.aaa.ldap.AuthzExtension] (default task-2) [] Exception: java.lang.RuntimeException: Cannot resolve principal 'rexecutor' at org.ovirt.engineextensions.aaa.ldap.AuthzExtension.doFetchPrincipalRecord(AuthzExtension.java:579) [ovirt-engine-extension-aaa-ldap.jar:] at org.ovirt.engineextensions.aaa.ldap.AuthzExtension.invoke(AuthzExtension.java:478) [ovirt-engine-extension-aaa-ldap.jar:] at org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.java:49) at org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.java:73) at org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.java:109) at org.ovirt.engine.core.sso.utils.NegotiateAuthUtils.doAuth(NegotiateAuthUtils.java:122) at org.ovirt.engine.core.sso.utils.NegotiateAuthUtils.doAuth(NegotiateAuthUtils.java:68) at org.ovirt.engine.core.sso.utils.NonInteractiveAuth$2.doAuth(NonInteractiveAuth.java:51) at org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.issueTokenUsingHttpHeaders(OAuthTokenServlet.java:183) at org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.service(OAuthTokenServlet.java:72) at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) at org.ovirt.engine.core.branding.BrandingFilter.doFilter(BrandingFilter.java:73) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at org.ovirt.engine.core.utils.servlet.LocaleFilter.doFilter(LocaleFilter.java:66) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at org.ovirt.engine.core.utils.servlet.HeaderFilter.doFilter(HeaderFilter.java:94) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:53) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) at io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:59) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292) at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:805) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_121] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_121] at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_121]
Right after that, I see in the log: 2017-07-04 17:50:25,718+02 ERROR [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-2) [] External Authentication Failed: Cannot resolve principal 'rexecutor'
and I don't see in the stack the modules you show me in org.ovirt.engine.core.aaa.filters.doAuth, I think the failure happens latter and ovirt won't manage to handle other authn modules.
Ok, that's bug, can you please open it?

Done in : https://bugzilla.redhat.com/show_bug.cgi?id=1468878.
Le 7 juil. 2017 à 13:51, Ondra Machacek <omachace@redhat.com> a écrit :
On Tue, Jul 4, 2017 at 6:05 PM, Fabrice Bacchella <fabrice.bacchella@orange.fr> wrote:
Le 1 juil. 2017 à 09:09, Fabrice Bacchella <fabrice.bacchella@orange.fr> a écrit :
Le 30 juin 2017 à 23:25, Ondra Machacek <omachace@redhat.com> a écrit :
On Thu, Jun 29, 2017 at 5:16 PM, Fabrice Bacchella <fabrice.bacchella@orange.fr> wrote:
Le 29 juin 2017 à 14:42, Fabrice Bacchella <fabrice.bacchella@orange.fr> a écrit :
> Le 29 juin 2017 à 13:41, Ondra Machacek <omachace@redhat.com> a écrit : > > How do you login? Do you use webadmin or API/SDK, if using SDK, don't > you use kerberos=True?
Ok, got it. It's tested with the sdk, using kerberos. But Kerberos authentication is done in Apache and I configure a profile for that, so I needed to add: config.artifact.arg = X-Remote-User in my /etc/ovirt-engine/extensions.d/MyProfile.authn.properties. But this is missing from internal-authn.properties. So rexecutor@internal is checked with my profil, and not found. But as the internal profil don't know about X-Remote-User, it can't check the user and fails silently. That's why I'm getting only one line. Perhaps the log line should have said the extensions name that was failing, not the generic "External Authentication" that did'nt caught my eye.
I will check that as soon as I have a few minutes to spare and tell you.
I'm starting to understand. I need two authn modules, both using org.ovirt.engineextensions.aaa.misc.http.AuthnExtension but with a different authz.plugin. Is that possible ? If I do what, in what order the different Authn will be tried ? Are they all tried until one succeed both authn and authz ?
Yes you can have multiple authn profiles and it tries to login until one succeed:
https://github.com/oVirt/ovirt-engine/blob/de46aa78f3117cbe436ab10926ac0c23f...
The order isn't guaranteed, but I think it's not important, or is it for you?
I'm not sure. As I need two org.ovirt.engineextensions.aaa.misc.http.AuthnExtension, the authentication will always succeed. It's the auhtz that fails as user as either in one backend or the other. So if ExtMap output = profile.getAuthn().invoke(..) calls the authz part I will be fine.
I think it's not possible to have 2 org.ovirt.engineextensions.aaa.misc.http.AuthnExtension with different authz.
The first authz ldap based backend is tried and return: 2017-07-04 17:50:25,711+02 DEBUG [org.ovirt.engineextensions.aaa.ldap.AuthzExtension] (default task-2) [] Exception: java.lang.RuntimeException: Cannot resolve principal 'rexecutor' at org.ovirt.engineextensions.aaa.ldap.AuthzExtension.doFetchPrincipalRecord(AuthzExtension.java:579) [ovirt-engine-extension-aaa-ldap.jar:] at org.ovirt.engineextensions.aaa.ldap.AuthzExtension.invoke(AuthzExtension.java:478) [ovirt-engine-extension-aaa-ldap.jar:] at org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.java:49) at org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.java:73) at org.ovirt.engine.core.extensions.mgr.ExtensionProxy.invoke(ExtensionProxy.java:109) at org.ovirt.engine.core.sso.utils.NegotiateAuthUtils.doAuth(NegotiateAuthUtils.java:122) at org.ovirt.engine.core.sso.utils.NegotiateAuthUtils.doAuth(NegotiateAuthUtils.java:68) at org.ovirt.engine.core.sso.utils.NonInteractiveAuth$2.doAuth(NonInteractiveAuth.java:51) at org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.issueTokenUsingHttpHeaders(OAuthTokenServlet.java:183) at org.ovirt.engine.core.sso.servlets.OAuthTokenServlet.service(OAuthTokenServlet.java:72) at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) at org.ovirt.engine.core.branding.BrandingFilter.doFilter(BrandingFilter.java:73) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at org.ovirt.engine.core.utils.servlet.LocaleFilter.doFilter(LocaleFilter.java:66) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at org.ovirt.engine.core.utils.servlet.HeaderFilter.doFilter(HeaderFilter.java:94) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:53) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) at io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:59) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292) at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:805) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_121] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_121] at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_121]
Right after that, I see in the log: 2017-07-04 17:50:25,718+02 ERROR [org.ovirt.engine.core.sso.utils.NegotiateAuthUtils] (default task-2) [] External Authentication Failed: Cannot resolve principal 'rexecutor'
and I don't see in the stack the modules you show me in org.ovirt.engine.core.aaa.filters.doAuth, I think the failure happens latter and ovirt won't manage to handle other authn modules.
Ok, that's bug, can you please open it?
participants (2)
-
Fabrice Bacchella
-
Ondra Machacek